News:

Registered a URL and setup a forum as the IPCam stuff really needed its own site vs my irregular blog posts about IPCam hacking at http://www.computersolutions.cn/blog

Author Topic: Maygion Kernel Assistance  (Read 14397 times)

April 02, 2011, 04:38:56 pm
HI. Excuse for my bad English.
I have received the new maygion  camera, but it has appeared on other hardware.
Old: 5V, NO Audio out.
New: 12V, Audio out.
I save linux.zip and romfs.img from the new camera by means of FoscamCloneRecovery and WinHex.
Has loaded them into the new camera. Linux works, but in/tmp/eye it is empty./ldr: no. The camera does not work. IPCamRepair has not helped.

The old camera with a new firmware:
Code: [Select]
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000048 exec:0x7F010000 -f
Image: 7 name:linux.zip base:0x7F020000 size:0x0009F180 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0C0000 size:0x0001D000 exec:0x7F0C0000 -a


W90P710 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Jun 13 2008
Memory Size is 0x800000 Bytes, Flash Size is 0x200000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

        MAC Address         : 00:00:00:00:00:01
        IP Address          : 192.168.1.252
        DHCP Client         : Disabled
        CACHE               : Enabled
        BL buffer base      : 0x00300000
        BL buffer size      : 0x00100000
        Baud Rate           : 115200
        USB Interface       : Enabled
        Serial Number       : 0x00000000


For help on the available commands type 'h'

Press ESC to enter debug mode .
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@localhost.localdomain) (gcc version 3.0) #504 Sun Sep 26 21:28:39 EDT 2010
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 1792
zone(0): 0 pages.
zone(1): 1792 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 7MB = 7MB total
Memory: 5592KB available (1213K code, 193K data, 40K init)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
i2c-core.o: i2c core module
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0C0000-800CFFFF [VIRTUAL 7F0C0000-800CFFFF] (RO)
RAMDISK driver initialized: 16 RAM disks of 1024K size 1024 blocksize
loop: loaded (max 8 devices)
No supported flash detected!
01 eth0 initial ok!
which:0
Linux video capture interface: v1.00
Winbond Audio Driver v1.0 Initialization successfully.
winbond.c winbond_flash_init 1308
POS-TAX flash device: 200000 at ff000000
Winbond flash device: Probing for AMD compatible flash...
MTD:  00bf 234bWinbond flash device: Found 1 x 2MiB CYC-FLASH at 0x0
Creating 2 MTD partitions on "Winbond flash device":
0x00000000-0x000e0000 : "data (1024k)"
0x000e0000-0x00200000 : "user (1024k)"
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver rt73
usb.c: registered new driver spca5xx
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
FAT: bogus logical sector size 38240
FAT: bogus logical sector size 38240
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: /bin/init
Command: mount -t proc none /proc
Command: mount -t ramfs none /tmp
Command: mkdir  /tmp/eye
Command: mount -t jffs2 dev/mtdblock1 /tmp/eye
Command: cd /tmp/eye
Command: ./ldr&
./ldr: Bad command or file name

sh 1: Child 12 died
[12]
Command: sh

Sash command shell (version 1.1.1)
/tmp/eye> new USB device :806d5e04-6fd940
hub.c: new USB device 1, assigned address 2

/tmp/eye> ls
/tmp/eye> cd /etc
/etc> ls
config
fccc.scr
host
hosts
inetd.conf
mppp.cfg
ppp
protocols
resolv.conf
services
/etc>

./ldr: Bad command or file name
0: 7F0C0000-800CFFFF [VIRTUAL 7F0C0000-800CFFFF] (RO)
MTD:  00bf 234bWinbond flash device: Found 1 x 2MiB CYC-FLASH at 0x0

New camera:
Code: [Select]
Image: 0 name:BOOT INFO base:0x7F010000 size:0x00000048 exec:0x7F010000 -af
Image: 7 name:linux.zip base:0x7F020000 size:0x0009F180 exec:0x00008000 -acxz
Image: 6 name:romfs.img base:0x7F0C0000 size:0x0001D000 exec:0x7F0C0000 -a


W90P745 Boot Loader [ Version 1.1 $Revision: 1 $ ] Rebuilt on Sep 23 2010
Memory Size is 0x800000 Bytes, Flash Size is 0x200000 Bytes
Board designed by Winbond
Hardware support provided at Winbond
Copyright (c) Winbond Limited 2001 - 2006. All rights reserved.
Boot Loader Configuration:

        MAC Address         : 00:09:00:05:00:01
        IP Address          : 0.0.0.0
        DHCP Client         : Enabled
        CACHE               : Enabled
        BL buffer base      : 0x00300000
        BL buffer size      : 0x00100000
        Baud Rate           : 115200
        USB Interface       : Enabled
        Serial Number       : 0x000004D2


For help on the available commands type 'h'

Press ESC to enter debug mode .
Cache enabled!
Processing image 1 ...
Processing image 2 ...
Processing image 3 ...
Processing image 4 ...
Processing image 5 ...
Processing image 6 ...
Processing image 7 ...
Unzip image 7 ...
Executing image 7 ...
Linux version 2.4.20-uc0 (root@localhost.localdomain) (gcc version 3.0) #504 Sun Sep 26 21:28:39 EDT 2010
Processor: Winbond W90N745 revision 1
Architecture: W90N745
On node 0 totalpages: 1792
zone(0): 0 pages.
zone(1): 1792 pages.
zone(2): 0 pages.
Kernel command line: root=/dev/rom0 rw
Calibrating delay loop... 39.83 BogoMIPS
Memory: 7MB = 7MB total
Memory: 5592KB available (1213K code, 193K data, 40K init)
Dentry cache hash table entries: 1024 (order: 1, 8192 bytes)
Inode cache hash table entries: 512 (order: 0, 4096 bytes)
Mount-cache hash table entries: 512 (order: 0, 4096 bytes)
Buffer-cache hash table entries: 1024 (order: 0, 4096 bytes)
Page-cache hash table entries: 2048 (order: 1, 8192 bytes)
POSIX conformance testing by UNIFIX
Linux NET4.0 for Linux 2.4
Based upon Swansea University Computer Society NET3.039
Initializing RT netlink socket
Starting kswapd
JFFS2 version 2.2. (C) 2001-2003 Red Hat, Inc.
i2c-core.o: i2c core module
Winbond W90N745 Serial driver version 1.0 (2005-08-15) with no serial options enabled
ttyS00 at 0xfff80000 (irq = 9) is a W90N745
Blkmem copyright 1998,1999 D. Jeff Dionne
Blkmem copyright 1998 Kenneth Albanowski
Blkmem 1 disk images:
0: 7F0C0000-9F0CC7FF [VIRTUAL 7F0C0000-9F0CC7FF] (RO)
RAMDISK driver initialized: 16 RAM disks of 1024K size 1024 blocksize
loop: loaded (max 8 devices)
No supported flash detected!
01 eth0 initial ok!
which:0
Linux video capture interface: v1.00
Winbond Audio Driver v1.0 Initialization successfully.
winbond.c winbond_flash_init 1308
POS-TAX flash device: 200000 at ff000000
Winbond flash device: Probing for AMD compatible flash...
MTD:  0020 22c4Winbond flash device: Found 1 x 2MiB ST M29W160DT at 0x0
Creating 2 MTD partitions on "Winbond flash device":
0x00000000-0x000e0000 : "data (1024k)"
0x000e0000-0x00200000 : "user (1024k)"
usb.c: registered new driver hub
add a static ohci host controller device
: USB OHCI at membase 0xfff05000, IRQ 15
hc_alloc_ohci
usb-ohci.c: AMD756 erratum 4 workaround
hc_reset
usb.c: new USB bus registered, assigned bus number 1
hub.c: USB hub found
hub.c: 2 ports detected
usb.c: registered new driver rt73
usb.c: registered new driver spca5xx
NET4: Linux TCP/IP 1.0 for NET4.0
IP Protocols: ICMP, UDP, TCP
IP: routing cache hash table of 512 buckets, 4Kbytes
TCP: Hash tables configured (established 512 bind 1024)
NET4: Unix domain sockets 1.0/SMP for Linux NET4.0.
FAT: bogus logical sector size 38240
FAT: bogus logical sector size 38240
VFS: Mounted root (romfs filesystem) readonly.
Freeing init memory: 40K
BINFMT_FLAT: bad magic/rev (0x74202d74, need 0x4)
Shell invoked to run file: /bin/init
Command: mount -t proc none /proc
Command: mount -t ramfs none /tmp
Command: mkdir  /tmp/eye
Command: mount -t jffs2 dev/mtdblock1 /tmp/eye
Command: cd /tmp/eye
Command: ./ldr&
[12]
Command: sh

Sash command shell (version 1.1.1)
/tmp/eye> [15]
« Last Edit: April 02, 2011, 04:45:16 pm by dvb »

April 02, 2011, 06:33:41 pm
MayGion.rar (linux.zip,romfs.img, photo)
http://files.mail.ru/FUQXVD

  • No avatar
  • *****
April 02, 2011, 10:36:40 pm
http://www.ucdot.org/archive/tb/tb20020917.shtml for an overview of what / why with flash stuff.

2 things -
From a quick glance - might want to try making the boot active, and also setting some of the variables.
Thats not why its not working though, but it doesn't hurt to do things right.

Also, make sure that you've flashed the webui - thats a hidden partition, and it sits roughly in the space where blkmem is not extending the flashfs up to, so I'd say you need to write that into the flash also.  Thats my guess from the logs you've put up.

Both flash sizes are the same, so most likely that...

Search the site for where to put the webui in memory - i can't remember offhand where i wrote that, and might also be on my blog - http://www.computersolutions.cn/blog , but i have written about it.

Will put your firmware files from the ru site in the file side also.

Lawrence.
« Last Edit: April 02, 2011, 10:43:44 pm by admin »

April 27, 2011, 05:07:32 pm
I have repaired the camera.  :)
I have created the romfs.img for recovery. (Attachment)

Upload repair img.
[Esc]
Del 6
fx 6 rep.img 0x7f0c0000 0x7f0c0000 –a
boot

Upload original img.
[Esc]
Del 6
fx 6 romfs.img 0x7f0c0000 0x7f0c0000 –a
boot


My IP address 10.1.1.2, router 10.1.1.1

ifconfig eth0 10.1.1.11 netmask 255.255.255.0
route add default netmask 255.255.255.0 gw 10.1.1.1 eth0
./fd


Use a ftp client to connect FTP server 10.1.1.11 user name: MayGion, password: maygion.com
Upload to /tmp/eye/ldr, /tmp/eye/app, /tmp/eye/www etc.

http://www.maygion.com/downloads/20100908/firmware3.1_full.rar and attachment
Ldr incompatible different hardware!

Reboot.

Works.